REPORTING ON INTERNAL CONTROL: THE SEC'S PROPOSED RULES

Implementation will bring substantial changes in reporting and auditing.

If the Securities and Exchange Commission adopts its 1988 rule proposal, Report of Management's Responsibilities, public companies will be required to assess the effectiveness of their internal control structures and report the results to the public. A so-called management report would contain this assessment along with the company's response to significant internal control recommendations by internal and independent auditors.

Although the time for its implementation may have come, the idea of a management report isn't new. For over a decade, financial statement prepares and auditors as well as legislators and regulators have advocated its use. As cases of fraudulent financial reporting and alleged audit failures continue to be reported, pressure for change has mounted. And the recent savings and loan crisis hasn't boosted public confidence in financial reporting.

This article discusses the pros and cons of the SEC's proposed rule, current responsibilities for internal control, and the changes public companies and their auditors face if the new rule is passed.

PRECEDENTS

Proposals for a management report go back at least to 1978, when the Commission on Auditors' Responsibilities (the Cohen commission) recommended it. A year later, the American Institute of CPAs special advisory committee on internal accounting control embraced the concept and the SEC made its first proposal requiring management reports.

The 1979 SEC rule proposal, Statement of Management on Internal Accounting Control, would have increased management's reporting responsibility and required auditors to expand their oversight roles by attesting to management's assertions. The SEC, however, withdrew its proposal, saying the private sector should be permitted to continue its own initiatives in this area. The SEC planned to monitor private initiatives and reconsider the need for a requirement at a later date.

In 1987, the management report idea resurfaced when the National Commission on Fraudulent Financial Reporting (the Treadway commission) recommended that management, in the company's annual report, "acknowledge management's responsibilities for the financial statements and internal control, discuss how these responsibilities were fulfilled and provide management's assessment of the effectiveness of the company's internal controls." However, the Treadway commission did not propose changing auditing standards to require an auditor issue a report on management's assertions.

The management report requirement also has arisen in some proposed legislation. For example, the General Accounting Office proposed that the 1989 S&L bailout bill require management and auditors to report on internal controls and compliance with specified laws and regulations related to the safety and soundness of federally insured institutions. However, the final bill did not include this requirement.

WHAT IS INTERNAL CONTROL?

A uniform approach to reporting on internal control implies there must be a common definition of internal control and common criteria for evaluation--and both must be designed to make the reporting process useful and effective. But currently there are at least three possible approaches.

1. An expanded definition. The Treadway commission concluded the concept of internal control should extend beyond accounting controls. "Internal controls broader than the internal accounting controls contemplated under the FCPA [Foreign Corrupt Practices Act of 1977] are necessary to reduce the incidence of fraudulent financial reporting." The May 1989 issues paper, Guidance on Internal Control, published by the National Association of Accountants, also extended the concept of internal control beyond the traditional accounting controls to include management and operational controls. …